The health care industry has moved at a rapid pace away from paper records to an electronic platform across almost all sectors — much of it at the encouragement and insistence of the federal government. Such rapid expansion has increased exponentially the risk to individuals in the privacy of their data and, increasingly, to their physical well-being when medical records are inaccessible through ransomware attacks. Recognizing the unique and critical nature of medical records, the United States Congress established the Health Care Industry Cybersecurity Task Force under the Cybersecurity Information Sharing Act of 2015 for the purpose of reviewing cybersecurity risks within the health care industry and identifying who will lead and coordinate efforts to address such risks among the various agencies. The Task Force has since issued a report setting forth six high-level imperatives that the health care industry needs to achieve in order to combat cybersecurity, and, notably, many of the vulnerabilities plaguing the industry identified in the Report as requiring correction are not necessarily related to specific flaws in the current cybersecurity framework, but rather susceptibilities presented by the infrastructure and associated regulatory regime that has evolved over the last few decades over the health care industry generally. That is, the current health care infrastructure by its nature exacerbates cybersecurity risk. Between a lack of information sharing of industry threats, risks, and mitigations, disparate leadership and governance goals for cybersecurity, the confluence and contradiction of existing federal and state laws, fragmentation in the fee-for-service delivery system, lack of care coordination, and disparate resources across and among sectors, the industry suffers from heightened cyber risk. Solutions that are reactive to problems within the current infrastructure will likely have little long term impact toward reducing cybersecurity vulnerabilities because they do not address the underlying system challenges. All of these confluences causes one to wonder whether if in fact the current health care delivery infrastructure is a contributing factor to the incidents of cybersecurity attacks and the exorbitant costs associated with resolving data breaches, should Congress look not just to curb breach incidents, but to address root cause systematic challenges in the health industry infrastructure that create increased exposure of cybersecurity threats? This article argues that cybersecurity risks will continue to be heightened and more costly to the health care industry as compared to other industries unless and until some general system redesign is achieved that allows for (1) greater sharing of resources among industry participants to ensure the same protections are implemented at all levels of the industry, which can be strengthened through greater interoperability of systems across the health care industry; and (2) increased focus and attention on the importance of cybersecurity issues as a priority among system reforms.
See Health Information Technology for Economic and Clinical Health Act, 42 U.S.C.A. § 300jj-34 (2009).
7.
Medical records contain sensitive personal information including name, birthdate, social security number, and medical condition. N.Akpan, “Has Health Care Hacking Become an Epidemic?”PBS Newshour, March23, 2016, available at <http://www.pbs.org/newshour/updates/hashealth-care-hacking-become-an-epidemic/> (noting that health data has fewer protections, but more valuable data). See alsoG.Slabodkin, “Ransomware Emerging as Medical Device Cybersecurity Threat,”Health Data Management, February20, 2017.
8.
SeePonemon Institute, LLC, 2018 Cost of a Data Breach Study: Global Overview (July2018): 14. Globally, the health care industry experiences less frequent data breaches than other sectors. Id. (noting that the health care industry is tied for 13th out of 17 in terms of the frequency of data breaches over the previous year). But seeM.Green, “Hospitals Are Hit with 88% of All Ransomware Attacks,”Health IT & CIO Review, July27, 2016, available at <http://www.beckershospitalreview.com/healthcare-information-technology/hospitals-are-hit-with-88-of-all-ransomware-attacks.html> (last visited November 20, 2019).
9.
Ponemon Institute, LLC, supra note 8, at 13.
10.
Id., at 18. (“Per capita cost is defined as the total cost of data breach divided by the size of the data breach (i.e., the number of lost or stolen records)).” Id.
11.
Id. The “Financial” sector experienced annual costs of $206 per capita. The lowest per capita cost was the “Public” sector, at $75 per capita. Id.
12.
Id., at 17 (defining “abnormal churn” as “the greater than expected loss of customers since the breach occurred”).
Cybersecurity Information Sharing Act was passed as part of the Consolidated Appropriations Act of 2016, Pub. L. No. 114-113, 129 Stat. 2242 (Dec. 18, 2015).
15.
6 U.S.C. § 1533(b) (2015).
16.
See generally Report, supra note 13. The Task Force has also issued a one-year update regarding its ongoing activities. See U.S. Dep't of Health & Hum. Servs., Public Health Emergency, Year One Activity Update, available at <https://www.phe.gov/Preparedness/planning/CyberTF/Pages/OneYearUpdate.aspx> (last visited November 20, 2019).
N. P.Terry, “Pit Crews with Computers: Can Health Information Technology Fix Fragmented Care?”Houston Journal of Health Law & Policy14 (2014): 129, 148 (examines our fragmented system's effects on IT in healthcare).
23.
See Report, supra note 13, at 31 (suggesting in Action Item 2.3.8 that “Industry and government should consider issuing a grand challenge, soliciting from stakeholders novel incentive structures that could be leveraged to address cybersecurity challenges specific to securing legacy systems, SDL, strategic and architectural approaches, and holistic data flow and system requirements for EHRs…”).
As will be discussed in more detail infra, interoperability can be seen as both a positive in the fight against cybersecurity risk for its ability to assure sufficient resource allocation across industry players (e.g., large hospital systems to small physician offices) to ensure a consistent prioritization of cybersecurity as a necessary focus, and a negative because of the increased risks posed by having even larger amounts of consolidated data subject to exposure. This Article posits that the benefits of resource allocation will outweigh the risks of data consolidation so long as the technology utilized to achieve interoper-ability contains appropriate mitigation tools. Thus, interoper-ability as a potential solution to cybersecurity risk is suggested with the understanding that interoperability must contemplate data protection as one of its primary goals.
Initially promoted with the enactment of HIPAA, Congress later enacted the Health Information Technology for Economic and Clinical Health Act, 42 U.S.C. §§ 300jj to jj-51 et seq. to further spur use of EHRs. SeeD.Blumenthal and M.Tavenner, “The “Meaningful Use” Regulation for Electronic Health Records,”New England Journal of Medicine363 (2010): 501, 501; see alsoD.Charles, et al., Adoption of Electronic Health Record Systems among U.S. Federal Acute Care Hospitals: 2008-2014, Off. of the Nat'l Coord. for Health Info. Tech., 23 ONC Data Brief 1 (April2015), available at <https://www.healthit.gov/sites/default/files/data-brief/2014HospitalAdoptionDataBrief.pdf> (last visited November 20, 2019).
28.
A report issued by the Office of the National Coordinator for Health Information Technology (ONC) tracked use of EHRs over time and noted that by 2008 only 9.4% of hospitals had adopted a basic EHR. See Charles, supra note 27, at 1.
29.
Centers for Disease Control, National Health Records Survey: Table. Percentage of Office-Based Physicians Using Any Electronic Health Record (EHR)/Electronic Medical Record (EMR) System and Physicians That Have a Certified EHR/EMR System, by U.S. State (2017), available at <https://www.cdc.gov/nchs/data/nehrs/2017_NEHRS_Web_Table_EHR_State.pdf> (last visited November 20, 2019). The HITECH Act provided incentive payments (and later imposed penalties) for adoption of “certified” EHR technology (CEHRT). CEHRT is technology that “stores data in a structured format” in accordance with certain established standards for use in the Centers for Medicare and Medicaid Services' (CMS) Promoting Interoperability Programs. SeeCenters for Medicare and Medicaid Services, “Certified EHR Technology,”CMS.gov, available at <https://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Certification.html> (last visited November 20, 2019).
30.
Health IT Dashboard, “Non-Federal Acute Care Hospital Electronic Health Record Adoption,”Off. of the Nat'l Coord. for Health Info. Tech. (2017), available at <https://dashboard.healthit.gov/quickstats/pages/FIG-Hospital-EHR-Adoption.php> (last visited November 20, 2019) (citing source data as the ONC/American Hospital Association (AHA), AHA Annual Survey Information Technology Supplement).
31.
SeeS.Yanamadala, et al., “Electronic Health Records and Quality of Care: An Observational Study Modeling Impact on Mortality, Readmissions, and Complications,”Medicine95 (2016): 1, 1-2, available at <https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4902473/pdf/medi-95-e3332.pdf> (last visited November 20, 2019).
32.
See, e.g., M.Freudenheim, “The Ups and Downs of Electronic Medical Records,”New York Times, October8, 2012; B.G.Arndt, et al., “Tethered to the EHR: Primary Care Physician Workload Assessment Using EHR Event Log Data and Time-Motion Observations,”Annals of Family Medicine15 (2017): 419, available at <http://www.annfammed.org/content/15/5/419.full.pdf+html> (last visited November 20, 2019).
33.
SeeD.J.Solove, “HIPAA Turns 10: Analyzing the Past, Present and Future Impact,”Journal of American Health Information Management Association84 (April2013): 22, available at <https://library.ahima.org/doc?oid=106325#.XWgDbuNKiUl> (last visited November 20, 2019).
34.
SeeK.Zetter, “Hacker Lexicon: A Guide to Ransomware, the Scary Hack That's on the Rise,”Wired, September17, 2015, available at <https://www.wired.com/2015/09/hacker-lexicon-guide-ransomware-scaryhack-thats-rise/>; see alsoD.R.Farringer, “Send Us the Bitcoin or Patients Will Die: Addressing the Risks of Ransomware Attacks on Hospitals,”Seattle University Law Review40 (2017): 937, 954 (noting that the invention of online currency Bitcoin has made ransomware attacks significantly easier for criminals and more difficult to prevent due to the anonymity of the payment).
35.
See Report, supra note 13, at 9.
36.
J. L.Tran, “Navigating the Cybersecurity Act of 2015,”Chapman Law Review19 (2016): 483, 483.
Cybersecurity Information Sharing Act (CISA) was passed as part of the Consolidated Appropriations Act of 2016, Pub. L. No. 114-113, 129 Stat. 2242 (2015); see also Tran, supra note 36, at 485 (noting the purpose of the act to “provide liability protections for information sharing between corporate entities, between corporate entities and the government, and between different government agencies”).
39.
6 U.S.C. § 1533(b). Congress directed the Task Force to (a) analyze approaches of other industries to cybersecurity threats; (b) analyze the challenges and barriers that private entities face in connection with cyber risks; (c) consider challenges related to devices and software that connection to EHRs; (d) provider HHS with educational materials on cybersecurity risks for industry dissemination; (e) establish plan for sharing of information regarding cybersecurity threats; and (f) report to Congress on findings and recommendations. Id.
40.
The six imperatives are: “1. Define and streamline leadership, governance, and expectations for health care industry cybersecurity. 2. Increase the security and resilience of medical devices and health IT. 3. Develop the health care work-force capacity necessary to prioritize and ensure cybersecurity awareness and technical capabilities. 4. Increase health care industry readiness through improved cybersecurity awareness and education. 5. Identify mechanisms to protect research and development efforts and intellectual property from attacks or exposure. 6. Improve information sharing of industry threats, weaknesses, and mitigations.” Id., at 21.
41.
Id., at 1 (“The health care industry in the United States is a mosaic, including very large health systems, single physician practices, public and private payors, research institutions, medical device developers and software companies, and a diverse and widespread patient population.”).
21st Century Cures Act, Pub. L. No. 114-255, 130 Stat. 1033 (2016).
58.
The law has myriad goals, other than that purpose specifically listed above. SeeE. ZacharakisLoumbas, Esq., “21st Century Cures Act: A Myriad of Health Law Remedies,”Health Lawyer29, no. 5 (June2017): 31 (noting that the Cures Act was for the purpose of “funding biomedical research and speed the approval of new drugs and medical devices” along with improvements to behavior health coverage and child and family support services).
59.
See Trusted Exchange Framework, supra note 56, at 4.
Trusted Exchange Framework, supra note 56, at 4. Information blocking is effectively when individuals, clinicians, or payers might block access to certain electronic health information even when there are not restrictions, such as HIPAA or HITECH, that would prevent such information from being shared. Id.
62.
Id.
63.
Id. The Trusted Exchange Framework is to establish a common set of principles for data exchange and the Common Agreement is to set forth terms by which health HINs will voluntarily be governed. Id., at 9.
64.
Id., at 17. While suggested, no common framework has been required or is mandatory, but merely voluntary.
65.
SeeS.R.Gering, “Electronic Health Records: How to Avoid Digital Disaster,”Michigan State University Journal of Medicine & Law16 (2012): 297, 310 (noting the consequences of the theft of a single laptop for two large federal agencies).
66.
Id. (recognizing the value of allowing those entities with available resources to dedicate such resources to proper security measures and share those resources across sectors).
67.
Id. This can be evidenced by its reference to release of drafts of the Trusted Exchange Framework and Common Agreement as an achievement in the one year update. See U.S. Dep't of Health and Hum. Servs., Health Care Industry Cybersecurity Task Force Year One Activity Update, available at <https://www.phe.gov/Preparedness/planning/CyberTF/Pages/One-YearUpdate.aspx> (last visited November 20, 2019) [hereinafter, “One Year Update”]. Since publication of the update, ONC has released a second draft both documents. See “Trusted Exchange Framework and Common Agreement,” HealthIT.gov, Office of the Nat'l Coordinator for Health Info. Tech., available at <https://www.healthit.gov/topic/interoperability/trusted-exchange-framework-and-common-agreement> (last visited November 20, 2019).
68.
Id. The Task Force reported approximately two to three updates for each imperative.
69.
The Task Force also noted the release of the Medical Device Safety Action Plan and a plan of action related specifically to the development of a “bill of materials” for each piece of medical technology in order to react to malware attacks in a more targeted way. See One Year Update, supra note 67. See alsoE.Snell, “Healthcare Cybersecurity Threats Require HHS Bill of Materials,”Health IT Security, available at <https://healthit-security.com/news/healthcare-cybersecurity-threats-require-hhs-bill-of-materials> (last visited November 20, 2019) (noting the importance of understanding which medical devices leverage certain protocols to appropriately quarantine devices following a ransomware attack).
70.
Id.
71.
See Freudenheim, supra note 32.
72.
See Report, supra note 13, at 22.
73.
Id. at 14.
74.
See, e.g., id., at 22, 37.
75.
D.Squires and D.Blumenthal, “Do Small Physician Practices Have a Future?”The Commonwealth Fund, May26, 2016, available at <https://www.commonwealthfund.org/blog/2016/do-small-physician-practices-have-future> (last visited November 20, 2019) (“But an important study…revealed that patients of physicians practicing in solo and small practices have lower rates of preventable readmissions than those in larger practices. Furthermore, many patients and physicians deeply value the personal relationships that smaller settings can cultivate.”)
76.
See Report, supra note 13, at 35.
77.
Id., at 35-36.
78.
See id., at 11, 14.
79.
For example, the Task Force noted that laws like the Physician Self-Referral Law and the Anti-kickback Statute inhibit sharing of resources and information among providers. Id. at 27. Competition is another factor that hinders collaboration, but coordination and sharing of resources across sectors could ease some of these business realities.
See Report, supra note 13, at 27; see also 42 C.F.R. § 411.355-357; 42 C.F.R. § 1001.952. Rather than utilize safe harbors or exceptions, many hospitals have chosen to purchase physician practices and/or employ physicians directly to avoid compliance concerns regarding compliance requirements. T.L.Greaney and D.Ross, “Navigating Through the Fog of Vertical Merger Law: A Guide to Counseling Hospital-Physician Consolidation under the Clayton Act,”Washington Law Review91 (2016): 199, 200.
91.
SeeNCSL Briefs for State Legislators, Combating Health Care Fraud and Abuse, Health Cost Containment and Efficiencies (September2010): 3, Table 2, available at <http://www.ncsl.org/portals/1/documents/health/Fraud-2010.pdf> (last visited November 20, 2019). CMS is aware of this issue and has included in its current proposed rules to the Stark Law information blocking as one of the restrictions that would be placed on those who donate EHR software or hardware or, potentially under the proposed regulations, cybersecurity software. See 84 Fed. Reg. at 55824.
92.
Report, supra note 13, at 27.
93.
Id.
94.
42 U.S.C. § 1899 (as added by Section 3022 of the ACA) (establishing the Medicare Shared Savings Program).
See Report, supra note 13, at 10-11. (noting challenges posed by connecting devices that were not originally established to connect).
97.
See, e.g., Dep't of Health and Hum. Servs., HHS Extends Comment Period for Proposed Rules to Improve the Interoperability of Electronic Health Information, Press Release, April 19, 2019 (extending the deadline for comment to June 3, 2019). Unlike insurance reforms and payment reforms contained within the ACA, laws promoting EHR interoperability appear to have been less political and easier to move forward in Congress. SeeD.Pittman, “Bipartisan Worry on Federal Health IT,”Politico, July24, 2014; see alsoSenator Angus King, King, Kaine, Isakson Introduce Bipartisam Bill to Modernize Public Health Data Systems, Press Release, June12, 2019.
SeeC.A.Tschider, “Enhancing Cybersecurity for the Digital Health Marketplace,”Annals of Health Law26 (2017): 1, 4-5. The FDA describes “digital health” to include “mobile health, health information technology, wearable devices, telehealth, telemedicine, and personalized medicine.” Id. While the NIST Framework does provide some guidance, it is voluntary and there is not widespread adoption across the industry of NIST standards.
100.
See Report, supra note 13, at 17. See alsoS.J.Shackelford, et al., “Securing the Internet of Healthcare,”Minnesota Journal of Law, Science & Technology19 (2017): 405, 409-410.
101.
See Report, supra note 13, at 22.
102.
U.S. Dep't of Health and Human Servs., Food and Drug Admin., Postmarket Management of Cybersecurity in Medical Devices: Guidance for Industry and Food and Drug Administration Staff, at 6 (December28, 2016) [hereinafter, “FDA Postmarket Guidance”].
103.
See Report, supra note 13, at 10.
104.
See Id., at 11.
105.
See supra notes 96-98.
106.
Food and Drug Administration, “About FDA,”available at <https://www.fda.gov/about-fda/what-we-do> (last visited July 26, 2019); see Tschider, supra note 99, at 16-17.
107.
SeeK. BoothWellington, “Cyberattacks on Medical Devices and Hospital Networks: Legal Gaps and Regulatory Solutions,”Santa Clara High Technology Law Journal30 (2014): 139, 158.
108.
71 Fed. Reg. 8389, 8391 (Feb. 16, 2006).
109.
Id. The HITECH amends HIPAA and thus penalties are imposed by the Office for Civil Rights.
110.
See 42 U.S.C. § 1395nn (2018); 42 U.S.C. § 1395nn (2018); 15 U.S.C. § 1 (2018) (The Sherman Act); 15 U.S.C. § 18 (2018) (The Clayton Act).
This article is not suggesting that the authors of the Report intend for the Report to be a manual for industry participants to stop cyberattacks. On the contrary, the Task Force acknowledges in the Report that some of the suggested changes must be legislative and/or administrative in nature. This article is suggesting, however, that having identified the necessary issues — some of which are systemic to the health care industry more generally — other steps must be adopted that do not feature cybersecurity as the driving force.
115.
While most details about Medicare for All have been very high level, there has been little mention of cybersecurity or interoperability as one of the goals. See, e.g., H.R. 676, “The United States Nat'l Health Care Act,” or “Expanded & Improved Medicare For All” (2019).
116.
United Kingdom's public health care system, the National Health Service (NHS), experienced the breach referenced herein.
117.
M.Field, WannaCry Cyber Attack Cost the NHS £92m as 19,000 appointments cancelled, The Telegraph (Oct. 11, 2018).
118.
See id.; see alsoC.Page, “NHS Admits Windows XP Is Still Running on More Than 2,000 Systems,”The Inquirer, July17, 2019.
119.
SeeC.Newdick, “Resource Allocation in the National Health Service,”American Journal of Law & Medicine23 (1997): 291, 291-295. See alsoD.Maguire, “Interoperability and the NHS: Are They Incompatible?”The King's Fund, August8, 2016, available at <https://www.kingsfund.org.uk/blog/2016/08/interoperability-and-nhs> (last visited November 20, 2019).
120.
B.R.Furrowet al., Health Law: Cases, Materials and Problems, 8th ed. (West Academic Publishing, 2008): at 931-32, 964-65.
121.
SeeK.Kane, “How Much Does Quality Cost? Analyzing the Patient Protection and Affordable Care Act's Value-Based Purchasing Provision and How It Could Affect the Delivery of Care by Hospitals,”Duquesne Business Law Journal14 (2011): 69, 74.
122.
Admittedly, having a comprehensive cybersecurity program will not prevent attacks, but may reduce expense in responding to the attack and shutting an attack down more quickly.
This should include not just small providers, but also safety net institutions that provide services to indigent populations. Current access issues for indigent populations further reiterates the ultimate argument of this article that system reform is a necessary first step to truly addressing cybersecurity, as providers are unlikely to include these safety net providers in proposed care delivery models due to the challenges of payor mix in making such models financially viable. SeeM.Meidell, “ACOs Face the Demographics Dilemma of Managed Care,”Annals of Health Law Advance Directive25 (2015): 14, 20-21.
127.
U.S. Dep't of Health and Hum. Servs., “Defining the PCMH,”Agency for Healthcare Research and Quality, available at <https://pcmh.ahrq.gov/page/defining-pcmh> (last visited November 20, 2019).
This is not to say that ACOs are the means by which cybersecurity can be addressed most effectively. Rather, it is to point out that reform efforts exist that could help ease some of the risk because the function of the ACO infrastructure will allow for sharing and collaboration of data without running afoul of existing regulatory and statutory limitations.
SeeCtrs. for Medicare and Medicaid Servs., “Accountable Care Organizations (ACOs): General Information,”available at <https://innovation.cms.gov/initiatives/aco/> (last visited November 20, 2019).
133.
G.M.Nussbaum, et al., “Securing Connected Devices in Health Care: Taking Proactive Action,”Journal of Health & Life Sciences Law12 (2019): 84, 87-93.
